CVE Intelligence
Medium Info disclosure

CVE-2017-5754 — Exposure of Sensitive Information in Arm Cortex-a

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.

Published Jan 4, 2018 · Updated Oct 14, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: intel

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.
How the score was calculated
  • EPSS 84.2% (30-day exploitation probability)+15
  • Technical severity (medium)+3

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation
Not confirmed
Not in CISA KEV — an absence of record, not proof it is unexploited.
EPSS FIRST
84.17%
ahead of 100% of scored CVEs · Oct 14, 2026
Affects
Arm
Cortex-a and 8 more
CVSS base
5.6
Medium · 3 source(s)

CISA SSVC assessment CISA

Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.

Exploitation
None
none · proof-of-concept · active
Automatable
No
can an attacker script the kill-chain steps
Technical impact
Partial
partial · total control of the vulnerable component

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

  1. Identify exposed assets running the affected vendor/product/version combinations (Arm Cortex-a, Intel Atom C, Intel Atom E…).
  2. Apply the fixed version or the patch documented under Remediation.
  3. EPSS ahead of 100% of scored CVEs: prioritize it in the patch queue.
  4. Search available logs for exploit probes matching the vulnerability class (info disclosure), errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

VendorProductVersionsStatusSource
Arm Cortex-a version 75 Vulnerable NIST National Vulnerability Database
Intel Atom C version c2308version c2316version c2338version c2350version c2358version c2508version c2516version c2518
and 24 more version c2530version c2538version c2550version c2558version c2718version c2730version c2738version c2750version c2758version c3308version c3338version c3508version c3538version c3558version c3708version c3750version c3758version c3808version c3830version c3850version c3858version c3950version c3955version c3958
Vulnerable NIST National Vulnerability Database
Intel Atom E version e3805version e3815version e3825version e3826version e3827version e3845 Vulnerable NIST National Vulnerability Database
Intel Atom X3 version c3130version c3200rkversion c3205rkversion c3230rkversion c3235rkversion c3265rkversion c3295rkversion c3405
and 1 more version c3445
Vulnerable NIST National Vulnerability Database
Intel Atom Z version z2420version z2460version z2480version z2520version z2560version z2580version z2760version z3460
and 22 more version z3480version z3530version z3560version z3570version z3580version z3590version z3735dversion z3735eversion z3735fversion z3735gversion z3736fversion z3736gversion z3740version z3740dversion z3745version z3745dversion z3770version z3770dversion z3775version z3775dversion z3785version z3795
Vulnerable NIST National Vulnerability Database
Intel Celeron J version j1750version j1800version j1850version j1900version j3060version j3160version j3355version j3455
and 2 more version j4005version j4105
Vulnerable NIST National Vulnerability Database
Intel Celeron N version n2805version n2806version n2807version n2808version n2810version n2815version n2820version n2830
and 15 more version n2840version n2910version n2920version n2930version n2940version n3000version n3010version n3050version n3060version n3150version n3160version n3350version n3450version n4000version n4100
Vulnerable NIST National Vulnerability Database
Intel Core I3 version 330eversion 330mversion 330umversion 350mversion 370mversion 380mversion 380umversion 390m
and 104 more version 530version 540version 550version 560version 2100version 2100tversion 2102version 2105version 2115cversion 2120version 2120tversion 2125version 2130version 2310eversion 2310mversion 2312mversion 2328mversion 2330eversion 2330mversion 2340ueversion 2348mversion 2350mversion 2357mversion 2365mversion 2367mversion 2370mversion 2375mversion 2377mversion 3110mversion 3115cversion 3120mversion 3120meversion 3130mversion 3210version 3217uversion 3217ueversion 3220version 3220tversion 3225version 3227uversion 3229yversion 3240version 3240tversion 3245version 3250version 3250tversion 4000mversion 4005uversion 4010uversion 4010yversion 4012yversion 4020yversion 4025uversion 4030uversion 4030yversion 4100eversion 4100mversion 4100uversion 4102eversion 4110eversion 4110mversion 4112eversion 4120uversion 4130version 4130tversion 4150version 4150tversion 4158uversion 4160version 4160tversion 4170version 4170tversion 4330version 4330tversion 4330teversion 4340version 4340teversion 4350version 4350tversion 4360version 4360tversion 4370version 4370tversion 5005uversion 5010uversion 5015uversion 5020uversion 5157uversion 6006uversion 6098pversion 6100version 6100eversion 6100hversion 6100tversion 6100teversion 6100uversion 6102eversion 6157uversion 6167uversion 6300version 6300tversion 6320version 8100version 8350k
Vulnerable NIST National Vulnerability Database
Intel Core I5 version 4570tversion 4570teversion 4590version 4590sversion 4590tversion 4670version 4670kversion 4670r
and 69 more version 4670sversion 4670tversion 4690version 4690kversion 4690sversion 4690tversion 5200uversion 5250uversion 5257uversion 5287uversion 5300uversion 5350hversion 5350uversion 5575rversion 5675cversion 5675rversion 6200uversion 6260uversion 6267uversion 6287uversion 6300hqversion 6300uversion 6350hqversion 6360uversion 6400version 6400tversion 6402pversion 6440eqversion 6440hqversion 6442eqversion 6500version 6500tversion 6500teversion 6585rversion 6600version 6600kversion 6600tversion 6685rversion 8250uversion 8350uversion 8400version 8600kversion 430mversion 430umversion 450mversion 460mversion 470umversion 480mversion 520eversion 520mversion 520umversion 540mversion 540umversion 560mversion 560umversion 580mversion 650version 655kversion 660version 661version 670version 680version 750version 750sversion 760version 2300version 2310version 2320version 2380p
Vulnerable NIST National Vulnerability Database

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector
Local
Attack complexity
High
Privileges required
Low
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

ScoreVersionSeverityExpl.ImpactScored by
5.6 CVSS 3.1 Medium 1.1 4.0 134c704f-9b21-4f2e-91b3-4a467353bcc0 via NIST National Vulnerability Database
5.6 CVSS 3.1 Medium — — CISA-ADP via CVE Program (cve.org) e CISA ADP
5.6 CVSS 3.0 Medium 1.1 4.0 nvd@nist.gov via NIST National Vulnerability Database
4.7 CVSS 2.0 Medium 3.4 6.9 nvd@nist.gov via NIST National Vulnerability Database
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N (score shown at the top: 134c704f-9b21-4f2e-91b3-4a467353bcc0)

Weakness MITRE

Weakness class according to MITRE’s CWE catalog.

CWE-200 · Exposure of Sensitive Information

Other CVEs with this weakness →

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

  • Local/physical vector: focus on endpoint telemetry (EDR) from affected hosts.
  • Look for anomalous data read/export volumes and access to sensitive records.
endpoint telemetry (EDR)application logsauthentication logs

Timeline

What happened to this CVE, newest first.

  • 2026
  • Affected products added · intel corporation/most modern operating systems
    Oct 14, 2026 · CVE Program (cve.org) e CISA ADP
  • SSVC assessment updated
    Oct 14, 2026 · CVE Program (cve.org) e CISA ADP
  • Record published
    Oct 14, 2026
  • Fix documented
    Oct 14, 2026 · NIST National Vulnerability Database
  • Affected products added · intel/atom c, intel/atom e, intel/atom x3, intel/atom z, intel/celeron j, intel/celeron n, intel/core i3, intel/core i5,
    Oct 14, 2026 · NIST National Vulnerability Database
  • CVSS changed · 5.6
    Oct 14, 2026 · NIST National Vulnerability Database
  • Source status changed · → Modified
    Oct 14, 2026 · NIST National Vulnerability Database
  • Record created in this database
    Oct 14, 2026 · Alertas do Telegram
  • 2018
  • CVE published
    Jan 4, 2018 · intel

Source activity

Repeated readings are counted rather than listed.

  • 1× References added · Oct 14, 2026 – Oct 14, 2026
  • 1× Official description updated · Oct 14, 2026 – Oct 14, 2026

References

66 on the record

Elsewhere on this site

Arm
every CVE for this vendor
Info disclosure
same class
CWE-200
other pages naming this weakness

Related CVEs (same products)

  • CVE-2021-0157 Insufficient control flow management in the BIOS firmware for some Intel(R) Processors… Nov 17, 2021
  • CVE-2021-0158 Improper Input Validation in Intel Celeron N2805 Nov 17, 2021
  • CVE-2021-0114 Insecure Default Initialization of Resource in Intel Atom C3000 Aug 16, 2021

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2017-5754 is "Exposure of Sensitive Information in Arm Cortex-a", rated Medium. It affects Cortex-a (Arm); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 5.6 describes technical severity. EPSS 84.17% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.

Sign in or create an account to comment and suggest corrections.